<html>
<head><meta charset="utf-8"><title>miri use-after-free · t-compiler · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/index.html">t-compiler</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html">miri use-after-free</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="219144099"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144099" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144099">(Dec 07 2020 at 21:57)</a>:</h4>
<p>Why does Miri not detect the user-after-free in <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=212a1f4acdea6428e83b74b33f2fb0b6">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=212a1f4acdea6428e83b74b33f2fb0b6</a>?</p>



<a name="219144119"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144119" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144119">(Dec 07 2020 at 21:57)</a>:</h4>
<p>cc <a href="https://github.com/rust-lang/rust/issues/79808">#79808</a></p>



<a name="219144233"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144233" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144233">(Dec 07 2020 at 21:58)</a>:</h4>
<p>It detects a double-free if you use <code>Box</code>es instead of <code>i32</code>s, but the use-after-free with <code>i32</code>s is also UB/unsafe.</p>



<a name="219144274"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144274" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144274">(Dec 07 2020 at 21:58)</a>:</h4>
<p>was the backing buffer actually freed or did the elements just get destructed?</p>



<a name="219144367"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144367" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144367">(Dec 07 2020 at 21:59)</a>:</h4>
<p>I'm not sure; the <code>std</code> code that's causing the UB is way beyond my knowledge</p>



<a name="219144480"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144480" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144480">(Dec 07 2020 at 22:00)</a>:</h4>
<p>Here it is if you want to take a look:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="c1">// impl VecDeque</span>
<span class="w">    </span><span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">make_contiguous</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="bp">self</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="p">[</span><span class="n">T</span><span class="p">]</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="k">if</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">is_contiguous</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">            </span><span class="kd">let</span><span class="w"> </span><span class="n">tail</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="kd">let</span><span class="w"> </span><span class="n">head</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="k">return</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">buffer_as_mut_slice</span><span class="p">()[</span><span class="n">tail</span><span class="o">..</span><span class="n">head</span><span class="p">]</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
<span class="w">        </span><span class="p">}</span><span class="w"></span>

<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">buf</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">buf</span><span class="p">.</span><span class="n">ptr</span><span class="p">();</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">cap</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">cap</span><span class="p">();</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">len</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">len</span><span class="p">();</span><span class="w"></span>

<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">free</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="w"> </span><span class="o">-</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">tail_len</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">cap</span><span class="w"> </span><span class="o">-</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="p">;</span><span class="w"></span>

<span class="w">        </span><span class="k">if</span><span class="w"> </span><span class="n">free</span><span class="w"> </span><span class="o">&gt;=</span><span class="w"> </span><span class="n">tail_len</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">            </span><span class="c1">// there is enough free space to copy the tail in one go,</span>
<span class="w">            </span><span class="c1">// this means that we first shift the head backwards, and then</span>
<span class="w">            </span><span class="c1">// copy the tail to the correct position.</span>
<span class="w">            </span><span class="c1">//</span>
<span class="w">            </span><span class="c1">// from: DEFGH....ABC</span>
<span class="w">            </span><span class="c1">// to:   ABCDEFGH....</span>
<span class="w">            </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">                </span><span class="n">ptr</span>::<span class="n">copy</span><span class="p">(</span><span class="n">buf</span><span class="p">,</span><span class="w"> </span><span class="n">buf</span><span class="p">.</span><span class="n">add</span><span class="p">(</span><span class="n">tail_len</span><span class="p">),</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="p">);</span><span class="w"></span>
<span class="w">                </span><span class="c1">// ...DEFGH.ABC</span>
<span class="w">                </span><span class="n">ptr</span>::<span class="n">copy_nonoverlapping</span><span class="p">(</span><span class="n">buf</span><span class="p">.</span><span class="n">add</span><span class="p">(</span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="p">),</span><span class="w"> </span><span class="n">buf</span><span class="p">,</span><span class="w"> </span><span class="n">tail_len</span><span class="p">);</span><span class="w"></span>
<span class="w">                </span><span class="c1">// ABCDEFGH....</span>

<span class="w">                </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
<span class="w">                </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">len</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="p">}</span><span class="w"></span>
<span class="w">        </span><span class="p">}</span><span class="w"> </span><span class="k">else</span><span class="w"> </span><span class="k">if</span><span class="w"> </span><span class="n">free</span><span class="w"> </span><span class="o">&gt;=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">            </span><span class="c1">// there is enough free space to copy the head in one go,</span>
<span class="w">            </span><span class="c1">// this means that we first shift the tail forwards, and then</span>
<span class="w">            </span><span class="c1">// copy the head to the correct position.</span>
<span class="w">            </span><span class="c1">//</span>
<span class="w">            </span><span class="c1">// from: FGH....ABCDE</span>
<span class="w">            </span><span class="c1">// to:   ...ABCDEFGH.</span>
<span class="w">            </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">                </span><span class="n">ptr</span>::<span class="n">copy</span><span class="p">(</span><span class="n">buf</span><span class="p">.</span><span class="n">add</span><span class="p">(</span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="p">),</span><span class="w"> </span><span class="n">buf</span><span class="p">.</span><span class="n">add</span><span class="p">(</span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="p">),</span><span class="w"> </span><span class="n">tail_len</span><span class="p">);</span><span class="w"></span>
<span class="w">                </span><span class="c1">// FGHABCDE....</span>
<span class="w">                </span><span class="n">ptr</span>::<span class="n">copy_nonoverlapping</span><span class="p">(</span><span class="n">buf</span><span class="p">,</span><span class="w"> </span><span class="n">buf</span><span class="p">.</span><span class="n">add</span><span class="p">(</span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">tail_len</span><span class="p">),</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="p">);</span><span class="w"></span>
<span class="w">                </span><span class="c1">// ...ABCDEFGH.</span>

<span class="w">                </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="p">;</span><span class="w"></span>
<span class="w">                </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">len</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="p">}</span><span class="w"></span>
<span class="w">        </span><span class="p">}</span><span class="w"> </span><span class="k">else</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">            </span><span class="c1">// free is smaller than both head and tail,</span>
<span class="w">            </span><span class="c1">// this means we have to slowly "swap" the tail and the head.</span>
<span class="w">            </span><span class="c1">//</span>
<span class="w">            </span><span class="c1">// from: EFGHI...ABCD or HIJK.ABCDEFG</span>
<span class="w">            </span><span class="c1">// to:   ABCDEFGHI... or ABCDEFGHIJK.</span>
<span class="w">            </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">left_edge</span>: <span class="kt">usize</span> <span class="o">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">right_edge</span>: <span class="kt">usize</span> <span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">                </span><span class="c1">// The general problem looks like this</span>
<span class="w">                </span><span class="c1">// GHIJKLM...ABCDEF - before any swaps</span>
<span class="w">                </span><span class="c1">// ABCDEFM...GHIJKL - after 1 pass of swaps</span>
<span class="w">                </span><span class="c1">// ABCDEFGHIJM...KL - swap until the left edge reaches the temp store</span>
<span class="w">                </span><span class="c1">//                  - then restart the algorithm with a new (smaller) store</span>
<span class="w">                </span><span class="c1">// Sometimes the temp store is reached when the right edge is at the end</span>
<span class="w">                </span><span class="c1">// of the buffer - this means we've hit the right order with fewer swaps!</span>
<span class="w">                </span><span class="c1">// E.g</span>
<span class="w">                </span><span class="c1">// EF..ABCD</span>
<span class="w">                </span><span class="c1">// ABCDEF.. - after four only swaps we've finished</span>
<span class="w">                </span><span class="k">while</span><span class="w"> </span><span class="n">left_edge</span><span class="w"> </span><span class="o">&lt;</span><span class="w"> </span><span class="n">len</span><span class="w"> </span><span class="o">&amp;&amp;</span><span class="w"> </span><span class="n">right_edge</span><span class="w"> </span><span class="o">!=</span><span class="w"> </span><span class="n">cap</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">                    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">right_offset</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
<span class="w">                    </span><span class="k">for</span><span class="w"> </span><span class="n">i</span><span class="w"> </span><span class="k">in</span><span class="w"> </span><span class="n">left_edge</span><span class="o">..</span><span class="n">right_edge</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">                        </span><span class="n">right_offset</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">(</span><span class="n">i</span><span class="w"> </span><span class="o">-</span><span class="w"> </span><span class="n">left_edge</span><span class="p">)</span><span class="w"> </span><span class="o">%</span><span class="w"> </span><span class="p">(</span><span class="n">cap</span><span class="w"> </span><span class="o">-</span><span class="w"> </span><span class="n">right_edge</span><span class="p">);</span><span class="w"></span>
<span class="w">                        </span><span class="kd">let</span><span class="w"> </span><span class="n">src</span>: <span class="kt">isize</span> <span class="o">=</span><span class="w"> </span><span class="p">(</span><span class="n">right_edge</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">right_offset</span><span class="p">)</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="kt">isize</span><span class="p">;</span><span class="w"></span>
<span class="w">                        </span><span class="n">ptr</span>::<span class="n">swap</span><span class="p">(</span><span class="n">buf</span><span class="p">.</span><span class="n">add</span><span class="p">(</span><span class="n">i</span><span class="p">),</span><span class="w"> </span><span class="n">buf</span><span class="p">.</span><span class="n">offset</span><span class="p">(</span><span class="n">src</span><span class="p">));</span><span class="w"></span>
<span class="w">                    </span><span class="p">}</span><span class="w"></span>
<span class="w">                    </span><span class="kd">let</span><span class="w"> </span><span class="n">n_ops</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">right_edge</span><span class="w"> </span><span class="o">-</span><span class="w"> </span><span class="n">left_edge</span><span class="p">;</span><span class="w"></span>
<span class="w">                    </span><span class="n">left_edge</span><span class="w"> </span><span class="o">+=</span><span class="w"> </span><span class="n">n_ops</span><span class="p">;</span><span class="w"></span>
<span class="w">                    </span><span class="n">right_edge</span><span class="w"> </span><span class="o">+=</span><span class="w"> </span><span class="n">right_offset</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>
<span class="w">                </span><span class="p">}</span><span class="w"></span>

<span class="w">                </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
<span class="w">                </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">len</span><span class="p">;</span><span class="w"></span>
<span class="w">            </span><span class="p">}</span><span class="w"></span>
<span class="w">        </span><span class="p">}</span><span class="w"></span>

<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">tail</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">tail</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">head</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">head</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="bp">self</span><span class="p">.</span><span class="n">buffer_as_mut_slice</span><span class="p">()[</span><span class="n">tail</span><span class="o">..</span><span class="n">head</span><span class="p">]</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="219144519"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144519" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144519">(Dec 07 2020 at 22:00)</a>:</h4>
<p><a href="https://doc.rust-lang.org/std/collections/struct.VecDeque.html#method.make_contiguous">https://doc.rust-lang.org/std/collections/struct.VecDeque.html#method.make_contiguous</a></p>



<a name="219144614"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144614" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144614">(Dec 07 2020 at 22:01)</a>:</h4>
<p>that method shouldn't deallocate anything</p>



<a name="219144956"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219144956" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> tm <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219144956">(Dec 07 2020 at 22:04)</a>:</h4>
<p>the UB is because you can read value multiple times, i.e., drop it twice for example</p>



<a name="219145003"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145003" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> tm <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145003">(Dec 07 2020 at 22:04)</a>:</h4>
<p>i.e., later from pop_front</p>



<a name="219145067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lqd <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145067">(Dec 07 2020 at 22:05)</a>:</h4>
<p>if you box your i32s miri will detect it IIUC</p>



<a name="219145118"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145118" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> tm <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145118">(Dec 07 2020 at 22:05)</a>:</h4>
<p>with copy types everything works fine :D</p>



<a name="219145209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145209">(Dec 07 2020 at 22:06)</a>:</h4>
<p>But something unsound is still going on even with copy types, no? Or is it not unsound, but just a bug?</p>



<a name="219145351"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145351" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145351">(Dec 07 2020 at 22:07)</a>:</h4>
<p>the implementation is unsound, but I don't see where it would cause UB with copy types</p>



<a name="219145376"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145376" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145376">(Dec 07 2020 at 22:08)</a>:</h4>
<p>Hmm. What's the difference between 'unsound' and 'UB' here?</p>



<a name="219145451"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145451" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145451">(Dec 07 2020 at 22:08)</a>:</h4>
<p>an unsound API allows causing UB from safe code</p>



<a name="219145496"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145496" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145496">(Dec 07 2020 at 22:08)</a>:</h4>
<p>UB is specified in the nomicon</p>



<a name="219145536"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219145536" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219145536">(Dec 07 2020 at 22:09)</a>:</h4>
<p>and is specific operations that are not allowed</p>



<a name="219146213"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219146213" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219146213">(Dec 07 2020 at 22:13)</a>:</h4>
<p>Okay, that makes sense. So what do you call the fact that you can pop copy types from an empty vecdeque? Is that just 'a bug'?</p>



<a name="219147031"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219147031" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219147031">(Dec 07 2020 at 22:22)</a>:</h4>
<p>that's unsound, like I said</p>



<a name="219147175"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219147175" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Léo Lanteri Thauvin <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219147175">(Dec 07 2020 at 22:23)</a>:</h4>
<p>Or a "soundness bug"? Or is that something completely different again? :D</p>



<a name="219148259"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148259" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148259">(Dec 07 2020 at 22:33)</a>:</h4>
<p><span class="user-mention silent" data-user-id="211727">Jonas Schievink</span> <a href="#narrow/stream/131828-t-compiler/topic/miri.20use-after-free/near/219147031">said</a>:</p>
<blockquote>
<p>that's unsound, like I said</p>
</blockquote>
<p>Oops :P</p>



<a name="219148317"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148317" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148317">(Dec 07 2020 at 22:34)</a>:</h4>
<p>Okay, I think I understand now.</p>



<a name="219148600"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148600" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148600">(Dec 07 2020 at 22:36)</a>:</h4>
<p>So why isn't Miri able to catch that? Or is it unsound, but the use of it doesn't cause UB?</p>



<a name="219148727"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148727" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148727">(Dec 07 2020 at 22:38)</a>:</h4>
<p>miri catches UB</p>



<a name="219148753"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148753" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148753">(Dec 07 2020 at 22:38)</a>:</h4>
<p>the existence of unsoundness can only be proven using tests</p>



<a name="219148772"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148772" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148772">(Dec 07 2020 at 22:38)</a>:</h4>
<p>So using the API with copy types does not cause UB?</p>



<a name="219148775"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148775" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148775">(Dec 07 2020 at 22:38)</a>:</h4>
<p>it[the existence of unsoundness] can not be disproven</p>



<a name="219148825"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148825" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148825">(Dec 07 2020 at 22:39)</a>:</h4>
<p>not language UB</p>



<a name="219148899"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148899" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148899">(Dec 07 2020 at 22:40)</a>:</h4>
<p>so it won't cause any miscompilations</p>



<a name="219148911"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148911" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148911">(Dec 07 2020 at 22:40)</a>:</h4>
<p>it's still incorrect <span aria-label="laughing" class="emoji emoji-1f606" role="img" title="laughing">:laughing:</span></p>



<a name="219148920"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148920" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148920">(Dec 07 2020 at 22:40)</a>:</h4>
<p>Wow, this stuff is confusing <span aria-label="laughing" class="emoji emoji-1f606" role="img" title="laughing">:laughing:</span></p>



<a name="219148982"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148982" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148982">(Dec 07 2020 at 22:41)</a>:</h4>
<p>Basically: using the unsound code with copy types isn't UB because it won't make the compiler do weird things, but it <em>is</em> incorrect</p>



<a name="219148998"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219148998" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219148998">(Dec 07 2020 at 22:41)</a>:</h4>
<p>I guess I'll understand better once we figure out what's causing the unsoundness.</p>



<a name="219149012"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149012" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149012">(Dec 07 2020 at 22:41)</a>:</h4>
<p>i already know what does</p>



<a name="219149019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149019">(Dec 07 2020 at 22:41)</a>:</h4>
<p>currently testing the fix</p>



<a name="219149106"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149106" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149106">(Dec 07 2020 at 22:42)</a>:</h4>
<p>naim94a said:</p>
<blockquote>
<p>Yes, It's still a use-after-free regardless</p>
</blockquote>
<p>wrt using it with copy types. I guess that's not correct?</p>



<a name="219149129"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149129" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149129">(Dec 07 2020 at 22:42)</a>:</h4>
<p>I guess because you don't "free" copy types</p>



<a name="219149208"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149208" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Léo Lanteri Thauvin <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149208">(Dec 07 2020 at 22:43)</a>:</h4>
<p><span class="user-mention silent" data-user-id="211727">Jonas Schievink</span> <a href="#narrow/stream/131828-t-compiler/topic/miri.20use-after-free/near/219144274">said</a>:</p>
<blockquote>
<p>was the backing buffer actually freed or did the elements just get destructed?</p>
</blockquote>
<p><span class="user-mention silent" data-user-id="211727">Jonas Schievink</span> <a href="#narrow/stream/131828-t-compiler/topic/miri.20use-after-free/near/219144614">said</a>:</p>
<blockquote>
<p>that method shouldn't deallocate anything</p>
</blockquote>



<a name="219149227"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149227" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Léo Lanteri Thauvin <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149227">(Dec 07 2020 at 22:43)</a>:</h4>
<p>I think this is what was meant there?</p>



<a name="219149327"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149327" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149327">(Dec 07 2020 at 22:44)</a>:</h4>
<p>Maybe?</p>



<a name="219149614"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149614" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149614">(Dec 07 2020 at 22:48)</a>:</h4>
<p>this method doesn't deallocate anything</p>



<a name="219149631"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149631" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149631">(Dec 07 2020 at 22:48)</a>:</h4>
<p>the backing buffer was not freed, so yeah. That was what is meant here i think</p>



<a name="219149846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149846">(Dec 07 2020 at 22:51)</a>:</h4>
<p>So does that mean there's also a memory leak? Or am I just not understanding :)</p>



<a name="219149872"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149872" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149872">(Dec 07 2020 at 22:51)</a>:</h4>
<p>no. <code>make_contiguous</code> does not deallocate anything.</p>



<a name="219149892"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149892" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149892">(Dec 07 2020 at 22:51)</a>:</h4>
<p>this means that for <code>Copy</code> types there isn't really a use after free</p>



<a name="219149938"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149938" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149938">(Dec 07 2020 at 22:52)</a>:</h4>
<p>because we never actually free anything in that case</p>



<a name="219149965"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149965" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149965">(Dec 07 2020 at 22:52)</a>:</h4>
<p>this is a use after free bug when using <code>VecDeque&lt;Box&lt;i32&gt;&gt;</code></p>



<a name="219149995"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219149995" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219149995">(Dec 07 2020 at 22:52)</a>:</h4>
<p>Actually, I just realized: why is anything being freed at all? Is that the root bug?</p>



<a name="219150003"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219150003" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219150003">(Dec 07 2020 at 22:52)</a>:</h4>
<p>Because it's just rearranging things; it shouldn't be dropping them</p>



<a name="219150019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219150019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219150019">(Dec 07 2020 at 22:53)</a>:</h4>
<p>I don't think it is</p>



<a name="219150032"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219150032" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219150032">(Dec 07 2020 at 22:53)</a>:</h4>
<p>You don't think it is <em>what</em>?</p>



<a name="219150044"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219150044" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219150044">(Dec 07 2020 at 22:53)</a>:</h4>
<p>It looks like it is just duplicating items</p>



<a name="219150081"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219150081" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219150081">(Dec 07 2020 at 22:53)</a>:</h4>
<p>That's weird...</p>



<a name="219150133"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219150133" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Naim A. <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219150133">(Dec 07 2020 at 22:54)</a>:</h4>
<p>When the VecDeque is dropped, all elements (except Copy) are dropped again (the queue should be empty)</p>



<a name="219150216"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219150216" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219150216">(Dec 07 2020 at 22:55)</a>:</h4>
<p>Basically, it's not a use-after-free <em>in the queue implementation</em>, but it allows performing a use-after-free outside of it, in safe code, and is hence unsound</p>



<a name="219150265"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219150265" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Noah Lev <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219150265">(Dec 07 2020 at 22:55)</a>:</h4>
<p>Huh. Well, I'm looking forward to seeing lcnr's PR so I get a better understanding :)</p>



<a name="219151317"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219151317" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> tm <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219151317">(Dec 07 2020 at 23:06)</a>:</h4>
<p>it looks like head index is not reduced modulo size - 1, which leaves VecDeq in inconsistent state (is_empty works under assumption that head &amp; tail are reduced already)</p>



<a name="219151339"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219151339" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219151339">(Dec 07 2020 at 23:06)</a>:</h4>
<p>yeah</p>



<a name="219151359"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219151359" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219151359">(Dec 07 2020 at 23:06)</a>:</h4>
<p>modulo <code>size</code>, not <code>size - 1</code> though</p>



<a name="219152879"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219152879" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lqd <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219152879">(Dec 07 2020 at 23:26)</a>:</h4>
<p>it may be a sign calling for more stateful/model-based property-based testing of the stdlib :)</p>



<a name="219153207"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219153207" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219153207">(Dec 07 2020 at 23:31)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust/issues/79814">#79814</a></p>
<p>and yeah, we really need to do a better job testing <code>VecDeque</code></p>



<a name="219813804"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219813804" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219813804">(Dec 14 2020 at 08:55)</a>:</h4>
<p>FWIW, it's not (currently) considered UB to use a value after it was moved (such as in the call to <code>drop</code>); see <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/188">https://github.com/rust-lang/unsafe-code-guidelines/issues/188</a><br>
(UB can still arise as a side-effect of the destructor doi</p>



<a name="219819538"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219819538" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219819538">(Dec 14 2020 at 09:56)</a>:</h4>
<p>ng something destructive, though)</p>
<p>[Zulip suddenly stopped letting me edit that message mid-way through^^]</p>



<a name="219819760"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219819760" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lcnr <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219819760">(Dec 14 2020 at 09:58)</a>:</h4>
<p>that's some perfect timing <span aria-label="laughing" class="emoji emoji-1f606" role="img" title="laughing">:laughing:</span></p>



<a name="219819828"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219819828" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219819828">(Dec 14 2020 at 09:58)</a>:</h4>
<p>the destructor did something destructive <span aria-label="stuck out tongue" class="emoji emoji-1f61b" role="img" title="stuck out tongue">:stuck_out_tongue:</span></p>



<a name="219831076"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/131828-t-compiler/topic/miri%20use-after-free/near/219831076" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/131828-t-compiler/topic/miri.20use-after-free.html#219831076">(Dec 14 2020 at 12:00)</a>:</h4>
<p>Race condition due to a non-atomic write <span aria-label="ok" class="emoji emoji-1f44c" role="img" title="ok">:ok:</span></p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>